…But Wait, There’s More!

In 2025, eight additional U.S. state privacy laws will go into effect, joining California, Colorado, Connecticut, Montana, Oregon, Texas, Utah, and Virginia:

  1. Delaware Personal Data Privacy Act (effective Jan. 1, 2025)
  2. Iowa Consumer Data Protection Act (effective Jan. 1, 2025)
  3. Nebraska Data Privacy Act (effective Jan. 1, 2025)
  4. New Hampshire Privacy Act (effective Jan. 1, 2025)
  5. New Jersey Data Privacy Act (effective Jan. 15, 2025)
  6. Tennessee Information Protection Act (effective July 1, 2025)
  7. Minnesota Consumer Data Privacy Act (effective July 31, 2025)
  8. Maryland Online Data Privacy Act (effective Oct. 1, 2025)

While many of these eight state privacy laws are similar to current privacy laws in effect, there are some noteworthy differences that you will need to be mindful of heading into the New Year. Additionally, if you did not take Texas, Oregon and Montana into consideration in 2024, now is the time to do so!

Here is a roadmap of key considerations as you address these additional state privacy laws.

1. Understand What Laws Apply to Your Organization

To help determine what laws apply to your organization, you need to know the type and quantity of personal data you collect and how it is used. Each of the eight new state laws differ with their scope of application, as their thresholds vary based on the 1) number of state residents whose personal data controlled or processed and 2) the percentage of revenue a controller derives from the sale of personal data.

Delaware, New Hampshire, and Maryland have the lowest processing threshold – 35,000 consumers.

Nebraska’s threshold requirements are similar to Texas’ threshold requirements: the law applies to any organization that operates in the state, processes or sells personal data, and is not classified as a small business as defined by the U.S. Small Business Administration.

Notably, Maryland and Minnesota will apply to non-profits, except for those that fall into a narrow exception.

See our chart at the end of this article for ease of reference.

2. Identify Nuances

Organizations will need to pay particular attention to Maryland’s data minimization requirements as it is the strictest of the eight. Under Maryland, controllers will have unique obligations to meet, including the following:

  • Limit the collection or processing of sensitive data to what is “reasonably necessary and proportionate to provide or maintain a specific product or service requested by the consumer to whom the data pertains.”
  • Cannot process minors’ (under 18 years old) personal data for targeted advertising.
  • A broad prohibition on the sale of sensitive data.

If a controller engages in the sale of sensitive data, under Texas’ privacy law, which went into effect in July 2024, requires controllers to include the following notice in the same place your privacy policy is linked: “NOTICE: We may sell your sensitive personal data.” Similarly, if a controller engages in the sale of biometric personal data, the following notice must be included in the privacy policy: “NOTICE: We may sell your biometric personal data.” Nebraska requires companies to obtain opt-in consent before selling sensitive data. Maryland prohibits the sale of sensitive data altogether.

Minnesota takes data inventory a step further, requiring companies to maintain an inventory of personal data processed and document and maintain a description of the policies and procedures that they adopt to comply with the act.

3. Refine Privacy Rights Management

All states provide consumers with the right to access, delete, correct (except Iowa), and obtain a copy of their personal data.

Minnesota’s law provides consumers with two additional rights:

  1. The right to request the specific third parties to whom a business has disclosed personal data. Controllers may choose to respond to such a request either by providing the names of the specific third parties to which it has disclosed the consumer’s personal data or the name of third parties to which it has disclosed any personal data.
  2. The right to question the results of a controller’s profiling, to the extent it produced legal effects. Consumers will have the right to be informed of the reason that the profiling resulted in a specific decision and be informed of the actions the consumers may take to secure a different decision in the future.

Aligning with California and Utah, Iowa requires controllers to provide notice and an opportunity to opt out of the processing of sensitive data.

Interestingly, Iowa does not affirmatively establish a right to opt-out of online targeted advertising.

4. Conduct Data Privacy Impact Assessments

Most state privacy laws require controllers to conduct data privacy impact assessments for high-risk processing activities such as the sale of personal data, targeted advertising, profiling, and sensitive data processing. Nebraska, Tennessee, Minnesota, and Maryland follow Oregon by including any processing activities that present a heightened risk of harm to a consumer. Maryland takes this a step further in requiring the assessment include an assessment of each algorithm that is used.

5. Update Privacy Notices

All state privacy laws require privacy notices at the time of collecting personal data. It is essential you keep your privacy notice up-to-date and ensure (at a bare minimum) it covers data categories, third-party sharing, consumer privacy rights options, and opt-out procedures. Minnesota also requires controllers to provide a “reasonably accessible, clear, and meaningful” online privacy notice, posted on its homepage using a hyperlink that contains the word “privacy.”

As state privacy laws stack up, having a structured, adaptable, and principles-based approach paves the path to sustainable compliance.

Make 2025 the year your privacy program doesn’t just meet the minimum—it excels.

Click here to view the 2025 US State Privacy Laws Applicability Chart

Consumer Privacy Update: What Organizations Need to Know About Impending State Privacy Laws Going into Effect in 2024 and 2025

Over the past several years, the number of states with comprehensive consumer data privacy laws has increased exponentially from just a handful—California, Colorado, Virginia, Connecticut, and Utah—to up to twenty by some counts.

Many of these state laws will go into effect starting Q4 of 2024 through 2025. We have previously written in more detail on New Jersey’s comprehensive data privacy law, which goes into effect January 15, 2025, and Tennessee’s comprehensive data privacy law, which goes into effect July 1, 2025. Some laws have already gone into effect, like Texas’s Data Privacy and Security Act, and Oregon’s Consumer Privacy Act, both of which became effective July of 2024. Now is a good time to take stock of the current landscape as the next batch of state privacy laws go into effect.

Over the next year, the following laws will become effective:

  1. Montana Consumer Data Privacy Act (effective Oct. 1, 2024)
  2. Delaware Personal Data Privacy Act (effective Jan. 1, 2025)
  3. Iowa Consumer Data Protection Act (effective Jan. 1, 2025)
  4. Nebraska Data Privacy Act (effective Jan. 1, 2025)
  5. New Hampshire Privacy Act (effective Jan. 1, 2025)
  6. New Jersey Data Privacy Act (effective Jan. 15, 2025)
  7. Tennessee Information Protection Act (effective July 1, 2025)
  8. Minnesota Consumer Data Privacy Act (effective July 31, 2025)
  9. Maryland Online Data Privacy Act (effective Oct. 1, 2025)

These nine state privacy laws contain many similarities, broadly conforming to the Virginia Consumer Data Protection Act we discussed here.  All nine laws listed above contain the following familiar requirements:

(1) disclosing data handling practices to consumers,

(2) including certain contractual terms in data processing agreements,

(3) performing risk assessments (with the exception of Iowa); and

(4) affording resident consumers with certain rights, such as the right to access or know the personal data processed by a business, the right to correct any inaccurate personal data, the right to request deletion of personal data, the right to opt out of targeted advertising or the sale of personal data, and the right to opt out of the processing sensitive information.

The laws contain more than a few noteworthy differences. Each of the laws differs in terms of the scope of their application. The applicability thresholds vary based on: (1) the number of state residents whose personal data the company (or “controller”) controls or processes, or (2) the proportion of revenue a controller derives from the sale of personal data. Maryland, Delaware, and New Hampshire each have a 35,000 consumer processing threshold. Nebraska, similar to the recently passed data privacy law in Texas, applies to controllers that that do not qualify as small business and process personal data or engage in personal data sales. It is also important to note that Iowa adopted a comparatively narrower definition of what constitutes as sale of personal data to only transactions involving monetary consideration. All states require that the company conduct business in the state.

With respect to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), Iowa’s, Montana’s, Nebraska’s, New Hampshire’s, and Tennessee’s laws exempt HIPAA-regulated entities altogether; while Delaware’s, Maryland’s, Minnesota’s, and New Jersey’s laws exempt only protected health information (“PHI”) under HIPAA. As a result, HIPAA-regulated entities will have the added burden of assessing whether data is covered by HIPAA or an applicable state privacy law.

With respect to the Gramm-Leach-Bliley Act (“GLBA”), eight of these nine comprehensive privacy laws contain an entity-level exemption for GBLA-covered financial institutions. By contrast, Minnesota’s law exempts only data regulated by GLBA. Minnesota joins California and Oregon as the three state consumer privacy laws with information-level GLBA exemptions.

Not least of all, Maryland’s law stands apart from the other data privacy laws due to a number of unique obligations, including:

  • A prohibition on the collection, processing, and sharing of a consumer’s sensitive data except when doing so is “strictly necessary to provide or maintain a specific product or service requested by the consumer.”
  • A broad prohibition on the sale of sensitive data for monetary or other valuable consideration unless such sale is necessary to provide or maintain a specific product or service requested by a consumer.
  • Special provisions applicable to “Consumer Health Data” processed by entities not regulated by HIPAA. Note that “Consumer Health Data” laws also exist in Nevada, Washington, and Connecticut as we previously discussed here.
  • A prohibition on selling or processing minors’ data for targeted advertising if the controller knows or should have known that the consumer is under 18 years of age.

While states continue to enact comprehensive data privacy laws, there remains the possibility of a federal privacy law to bring in a national standard. The American Privacy Rights Act (“APRA”) recently went through several iterations in the House Committee on Energy and Commerce this year, and it reflects many of the elements of these state laws, including transparency requirements and consumer rights. A key sticking point, however, continues to be the broad private right of action included in the proposed APRA but absent from all state privacy laws. Only California’s law, which we discussed here, has a private right of action, although it is narrowly circumscribed to data breaches.  Considering the November 2024 election cycle, it is likely that federal efforts to create a comprehensive privacy law will stall until the election cycle is over and the composition of the White House and Congress is known.

NJDEP Publishes New Climate Change Rule Proposal

Substantial changes to NJDEP’s use Coastal, Flood Hazard, Wetland and Stormwater regulatory programs are coming that will severely impact proposed and existing development. NJDEP published its Protecting Against Climate Threats (PACT) Resilient Environments and Landscapes (REAL) rule in the August 5, 2024 New Jersey Register and has up to a year to adopt the proposed amendments.

The proposal is extensive and will implement sweeping regulatory changes across various regulatory permitting programs, affecting new development and redevelopment, and substantial improvements to existing development. The proposal relies on several reports and studies commissioned or prepared by NJDEP, including the NJ Scientific Report on Climate Change (NJ Climate Science Report), the New Jersey Climate Change Alliance Science and Technical Advisory Panel (STAP) “Rising Seas and Changing Coastal Storms” report prepared by Rutgers University, and two rainfall studies in 2021, which predict a less than 17% chance that sea level rise (“SLR”) will exceed 5.1 feet by Year 2100, and that the State’s precipitation rates and intensity are expected to increase through the Year 2100. DEP is using this very conservative less than 17% chance as the basis for these proposed rules.

NJDEP will establish a regulatory Inundation Risk Zone (IRZ) largely in coastal areas along tidal waters that are predicted to be at risk of daily inundation or standing flood waters of up to 5.1 feet (by Year 2100). The extent of the IRZ is determined by adding 5 feet to the calculated mean higher high water (MHHW) line elevation. Projects in the IRZ involving new residential development, critical buildings and substantial improvements to existing structures will need to meet onerous enhanced risk assessment criteria including an alternatives analysis designed to avoid the risk (a/k/a discourage building). The rule will also establish a new Climate Adjusted Flood Elevation (CAFE) in tidal flood hazard areas, which represents a 5-foot addition to FEMA’s 100-year flood elevation based on NJDEP’s very conservative SLR predictions.

Numerous other proscriptive measures are proposed. Some of the more noteworthy provisions are listed below.

General 

  • New burdens will be imposed regarding pre-commencement work notices, including that such notices be made no more than 14 days in advance of the start of work in addition to reporting requirements for completion of work. In our experience, notices similar to these are simply filed and are merely a regulatory burden.

Coastal 

  • Non-mainland (barrier island) coastal centers will be extinguished and, in many cases, strict new impervious cover limitations (3%) and vegetative preserve/plantings requirements will become applicable. This makes development or redevelopment in most of the barrier islands improbable, if not impossible.
  • A 3% cover limit will be applicable even in designated centers for lands identified as a Coastal Environmentally Sensitive Area, even if these areas can be otherwise developed with permits from discrete programs such as wetlands or flood hazard areas.
  • Construction continuation rights beyond the permit expiration date in the CAFRA Individual Permit context will be curtailed based on new requirements to justify the continuation based on the reasonable financial investment of the permittee “in proportion to the project as a whole”.
  • The CAFRA infill exception for a single-family house or duplex in a coastal high hazard area and erosion hazard area will be removed for parcels in the IRZ.

Wetlands 

  • Limitations and mitigation requirements will be enhanced with respect to wetland buffers and permitting.
  • New conditions will be imposed for wetland general permits requiring stormwater compliance for projects that are a major development, in contrast to the current rules which only require stormwater compliance if the wetland and/or buffer impacts are considered major development thresholds.
  • The rules will require General Permit applicants to demonstrate “no other practicable configuration” that would avoid or reduce the impacts to wetlands, effectively holding General Permit applicants to standards similar to the alternatives analysis required for an Individual Permit, contrary to the purpose of the General Permit program as a streamlined approval process.
  • Wetland buffer averaging plan approvals will impose onerous conditions requiring placement of conservation restrictions on the entire wetland and buffer complex, whether or not a project has only limited impacts and additional future regulated activities would otherwise be allowed under NJDEP’s rules, but for the conservation restriction.

Flood Hazard 

  • Permittees will need to recertify that flood hazard areas remain unchanged if work is not commenced within 180 days after a permit is issued, and the work must involve elements of permanent construction of a habitable structure and not only site clearing/preparation, excavation, roadwork or construction of accessory structures (garages). If flood hazard conditions have changed, the project may need to be revised to address the changed conditions, and NJDEP approval obtained before the approved work may occur.
  •  A FEMA Letter of Map Revision approval will be required for certain projects involving minimal flood elevation increases before NJDEP will take action on the permit application. This will add a substantial period of time to the review since FEMA is not required to make a decision within a specified time period, unlike DEP which must adhere to the 90-day law time periods for decision making.
  •  Single-family home subdivisions with more than two units will be held to the same access road elevation requirements currently applicable only to muti-residential and critical buildings, and NJDEP is removing the minimal flexibility currently afforded to redevelopment projects that allows for access roads to be up to a foot below the applicable flood elevation where it is not feasible to elevate. This will make many developments and redevelopments infeasible. There is no clarity on the issue of how far dry access must extend for it to be approvable by DEP.
  • New criteria will be imposed for access roads including that they must accommodate two-way traffic of motor vehicles providing access to and from each building for the duration of the flood.
  • The current restriction on construction of a single-family home on a lot created after 2007 in a fluvial flood hazard area if there is already an existing habitable building or authorization for same from NJDEP will be extended to multi-residence buildings.
  • Critical and multi-residence buildings will be required to grade pedestrian areas outside of the building footprint to 1 foot above CAFE subject to certain non-feasibility conditions.
  • Limitations and mitigation requirements will be enhanced with respect to riparian buffers and permitting, including removal of the current exemptions for disturbance in truncated riparian zones and along manmade channels conveying stormwater.
  • The land area subject to 150-foot riparian zone buffers associated with threatened or endangered species habitat is being expanded. Activities within 25 of top of bank will be curtailed.
  • A permit will be required to conduct horizontal directional drilling below riparian zones (or wetlands), and enhanced permitting requirements will be imposed for solar panels in a flood hazard area.
  • A Verification will need to be obtained for projects impacting riparian zones.

Stormwater 

  • Stormwater requirements will be enhanced including new requirements on redevelopment of 80% TSS removal for stormwater runoff for new and redeveloped motor vehicle surface (increased from 50% for redeveloped impervious surfaces).

The proposed amendments do nothing meaningful to incentivize development opportunities in areas outside of the IRZ or CAFE. The FHA hardship provisions do not provide meaningful opportunities for relief, and in fact, the proposal imposes new conditions making it even less likely that hardship relief may be obtained.

Legacy (previously, grandfathering) provisions remain consistent with current NJDEP rules and depend largely on securing relevant approvals or the filing of a complete application before the rules become effective. Applications submitted before the effective date and declared technically complete will qualify for legacy status.

Three public hearing dates are scheduled (September 5, 12 and 19, 2024) and comments on the rule proposal must be submitted by November 3, 2024. If you have questions regarding qualification for legacy status or how the forthcoming rules may affect your project, please contact one of the attorneys in our Environmental Department. A courtesy copy of the draft proposal can be found  here.

NJDEP Proposes Bald Eagle Removal and Other Changes to New Jersey’s Threatened and Endangered Species Lists

On June 3, 2024, the New Jersey Department of Environmental Protection announced a rule proposal which would update the endangered species and the nongame species lists promulgated by the Fish & Wildlife Endangered and Nongame Species Program (“ENSP”). These proposed updates would reflect, among other changes, the recategorization of the conservation status of certain species from the ENSP lists along with other structural and organizational amendments.

Primarily, the proposal celebrates the prospective reduced conservation status of three species, including the Peregrine Falcon, Bobcat, and Cope’s Gray Treefrog which each will have their conservation status reduced from “Endangered” to “Threatened.”

More significantly, the Bald Eagle, Red-headed Woodpecker, and Osprey are proposed to have their status reduced to “Special Concern” or “Secure/Stable.” The Department has further proposed partial conservation status reductions for the non-breeding populations of certain bird species including the Yellow-crowned Night-Heron, and Red-headed Woodpecker which have both been reduced to “Special Concern” for non-breeding activities. In effect, these species are being delisted, which is significant for Land Resource permitting under the Coastal Rules and Freshwater Wetlands Protection Act. This also should impact permitting under Pinelands Commission regulations.

Inapposite to those species having their conservation status reduced, the Department has proposed increased conservation designations for thirty (30) species, including select species particularly impactful to development and redevelopment initiatives in New Jersey. Those include three species of bat, the Northern Myotis, Little Brown Bat, and Tricolored Bat, which will each move from an undetermined/unknown status to “Endangered.”

Lastly, the Department proposes moving currently threatened species listed on the nongame species list at N.J.A.C. 7:25-4.17 to the endangered species list at N.J.A.C. 7:25-4.13. This restructuring will leave the species’ conservation status unchanged and includes a number of special species for New Jersey development and redevelopment, such as the Bobolink and Grasshopper Sparrow.

In addition to these conservation status changes, the Department has proposed a new procedure which would allow the addition of species to the list of endangered species by notice of administrative change when that species has been added to the Federal list of endangered and threatened species of wildlife pursuant to the Endangered Species Act of 1973 at 16 U.S.C. § 1531 et seq. and is indigenous to New Jersey. The Department notes this procedure seeks to further the goal of creating a listing that is more consistent with the Federal standard but in doing so the State will obviate the typical Administrative Procedure Act public comment process.

Matthew L. Capone contributed to this article

How Technological Advances Possibly Affect Automobile Insurance Policy Holders in New Jersey

In the 1970’s, “no-fault” insurance laws were enacted in New Jersey and several other states in response to criticism regarding the time-consuming and costly process of determining who was at-fault when an accident occurred. 

No fault insurance laws sought to streamline the claims process.  One key feature allowed insurers to pay for medical treatment of their injured policyholders.  This allowed for timely treatment and provider payment.  NJ automobile insurance policies offered up to $250,000 in coverage for medical treatment.  Recent changes in law now allow insureds to choose less coverage for medical treatment.

Further, recent technological advances change the way insurance customers choose coverage online.  While customers are served by the ease, flexibility, and pricing of policies through internet platforms, some adverse consequences naturally flow.  In this article, we discuss the changes, the consequences and subsequent response from participants and 3rd parties to address these outcomes.

Background

In the 1960’s, many more vehicles were entering into American roadways than in previous decades.  Baby boomers were coming of age and more cars were sold than ever before.  A natural consequence was automobile accidents and as a result, the necessary adjudication of which party caused the collision.

Insured and insurers alike expressed criticism of the process which consisted of petitioning the civil court system to resolve disputes.  In response, state legislatures adopted laws designed to streamline the process, and the 1970’s, many states adopted policies allowing injured accident victims to recover damages from their own auto insurance policies.

Almost half of the United States now have similar laws where policyholders are entitled to “benefits” from their own policies.  This of course means insurers are on the hook for more compensation, a fact they obviously utilized to lobby legislatures to place certain restrictions on the right to sue for damages not only against the insurer but against the tortfeasor as well.

One of the “trade-offs” made by the legislation was injured parties giving up some of their rights to sue under certain circumstances.

New Jersey No-Fault Law and Application

New Jersey’s no-fault laws have been amended throughout the years.  One of the most profound changes to the law occurred in 1998 with the passage of the Automobile Insurance Cost Reduction Act (“AICRA”).  This change in law gave NJ residents the opportunity to purchase a standard or basic policy.

The standard policy is much like a typical no-fault policy containing Personal Injury Protection (PIP) which pays for medical treatment (more on this in a moment); liability coverage for injury or property damage to another; and uninsured/underinsured coverage which kicks in if the at-fault driver has no or insufficient coverage.

A basic policy provides minimum coverage in certain areas such as personal liability, property damages, and medical benefits.  Because having automobile insurance is mandatory, the purpose of the basic policy was essentially to afford an option to those who simply wanted to follow State mandates.

With regard to the right to sue restrictions, a New Jersey insured was and still is offered a choice – give up the right to sue for “non-permanent” injuries (those with no objective medical evidence of permanency) and have the premium reflect a savings or retain the right to sue (zero threshold) and pay a much higher premium to offset the cost.  Further, one of the things insurers had to trade was that victims would have $250,000 worth of PIP coverage to pay for medical expenses.

Changes to NJ No-Fault Insurance and Consequences

The AICRA changes have been in effect for years.  Since that time, the internet altered the manner in which policyholders interact with insurers when choosing coverages.

The internet streamlines the sales process for many businesses.  Insurance is no different.  What is troubling about this streamlining is the lack of guidance users receive from insurance companies regarding their choice of coverage.

For example, one website asks you to choose between:

  • More Affordable
  • Popular Coverage
  • More Coverage

It is not so much that the choices are misleading – they aren’t.  However, other than these descriptions, there is little explanation of their consequences.  If you choose the “more affordable” option, you’re led to a screen that explains the coverages in more detail.

Do people read all the information?

Can they understand the language even if they do decide to read it?

Could it be that the ease of picking the cheapest option is too much to overcome?

Consider this description from a law firm in Maryland:

“PIP is easy to overlook, especially in this age of online insurance applications. It’s one box out of 200 that you can check. The application will say something like, “Waive PIP and save $57.” The applicant clicks and saves 57 bucks…when in reality, they’ve lost $2,500 if they get in an auto accident. Too many Maryland policyholders waive their PIP coverage. It’s really a good coverage not to waive. “

Likewise, in New Jersey’s Standard Coverage Selection Form, used by insurance companies as a questionnaire to draft a proposed policy, the PIP limits selection form actually lists the savings from choosing lower limit PIP coverage.  Remarkably, no such comparison exists on the Form for reductions in Bodily Injury/Liability limits.

In the old days, an insurance agent was tasked to explain various coverages.  A real human being who would answer questions depicting real word scenarios involving accidents.  This obviously allowed for more informed choices.

Now, a great deal of selling is done online.  Many cost-aware customers might respond only to a difference in price.  Many can and do simply choose the cheaper alternative.  This could cause problems later if an accident occurs and a claim is made.

A Potential Problem with Minimal Coverages

Consider a situation where the insured has the minimum coverages for PIP – $15,000.  The insured sustains a back injury and begins treatment.  The Emergency Room visit totals $6,000 complete with 3 level CT scans which reveal problems with the upper and lower back.  The insured then follows up with an orthopedic who requests MRI scans on the back which equal another $2,500.  Add in some physical therapy and the $15,000 PIP limits are exhausted in a couple of months.

None of this is a problem if the scans fail to reveal a major issue.  A soft tissue injury is serviceable under this scenario in that the insured gets treatment and is on the way to recovery.  If the scans reveal problems, such as multiple herniated discs and impingement on the spinal cord, treatment options become a tricky proposition.

The treatment is tricky because the benefits are gone.  Now the injured party must seek other options – some of these can be costly.

Responding to the Need

In response to the above, providers, lawyers and other market participants stepped in to serve the need for accident victims to secure medical treatment.  The following are some of those alternative payment methods.

Letters of Protection

Letters of protection (LOP’s) are agreements between the injured party’s attorney and a medical provider that the medical bills will be “protected” by the proceeds of any settlement received.  In return for the attorney’s promise to honor the lien against file, medical providers will perform a variety of treatments to the plaintiff, including surgery.  Surgery is often a deciding factor in the plaintiff’s ability to secure the treatment because normally, the case’s settlement value is increased after the procedure.

Use Existing Health Insurance to Pay Bills After PIP is Exhausted

In some instances, plaintiffs can use their own health insurance to pay for accident medical bills.  In NJ, insureds can choose which coverage is primary.  However, some health insurance policies exclude coverage for car accidents.  The standard health insurance limitations apply as well.  These include the need to pay deductibles, co-payments and sometimes co-insurance.  Further, there may be limits on the choice of medical provider.  Some policies require doctors to be “in network”.

Litigation Funding

In many cases, litigation funding is used to pay for much-needed medical treatment.  Originally utilized to bridge the gap between accidents and settlement, litigation funding sought to alleviate the need for plaintiffs to accept low-ball settlement offers simply because they were struggling financially.  Because lawsuit funding is the sale of a portion of the future proceeds of a personal injury case, they are sometimes used to pay for surgical or other procedures when there is no coverage available.

Technological Advances and Practical Trade-offs

Technology has certainly made life more convenient over the years.  Conveniences exist today that weren’t in our collective consciousness 20 years ago.  Consider being able to speak via video conference to someone on the other side of the world for FREE, when the toll charges for an overseas telephone call were many dollars only a short time ago.

But technology can cut both ways.  The ease with which insurance consumers can pick coverages that may or may not be in their best interest may be one such trade-off.  Thankfully, market participants (doctors, lawyers, litigation finance companies) step in and address the outcomes which naturally arise.  Free markets usually perform this function admirably.

For more insurance and reinsurance legal news, click here to visit the National Law Review.

© Copyright 2022 Fair Rate Funding

New Jersey Employers Are Now Required to Provide Written Notice Before Using Tracking Devices in Employee-Operated Vehicles

Earlier this year, New Jersey Governor Phil Murphy signed into law Assembly Bill No. 3950, which requires employers in the State to provide written notice to an employee before using a tracking device on a vehicle used by the employee. The new law, which went into effect on April 18, 2022, recognizes that employers may have a legitimate business interest in being able to track their workforce’s whereabouts—particularly when traveling or working offsite—while also reconciling that with the protection of workers’ privacy rights. At the very least, the days of covertly tracking employee vehicles appear to be a thing of the past.

The law defines “tracking device” as any “electronic or mechanical device which is designed or intended to be used for the sole purpose of tracking the movement of a vehicle, person, or device,” with a specific carveout for devices used solely for the purpose of documenting employee expense reimbursement.

Significantly, the written notice requirement applies to the use of tracking devices in any vehicles used by an employee. It does not matter whether it is an employee’s personal vehicle (whether owned or leased) or company-owned or provided. Written notice must be provided regardless.

Failure to comply with the law’s notice requirements can carry substantial penalties. An employer who knowingly makes use of a tracking device in a vehicle used by an employee without providing written notice to the employee shall be subject to a civil penalty up to $1,000.00 for the first violation, and then up to $2,500.00 for each subsequent violation. These fines can add up quickly, especially for service businesses with large vehicle fleets, among others. Additionally, it is possible that failure to comply with the law’s notice requirements may implicate employee privacy rights that could lead to further civil exposure.

Private employers within the State must ensure they have appropriate policies and procedures in place to comply with the new law’s requirements and insulate their businesses from potential liability for violations. While it does not specify what the required “written notice” must look like or how it must be conveyed to employees, at minimum employers should update their employee handbooks as well as provide a stand-alone, written notice to employees, with signed confirmation and acknowledgement of receipt. Additionally, rule and regulations regarding GPS tracking of employee vehicles may vary from state to state, so employers with a multi-state presence or service area need to be aware of the different laws that may apply to them depending on where their employees are working.

Employers who have not yet updated their forms and procedures should immediately contact counsel and take steps to ensure that they are in compliance. Similarly, it may be prudent for employers who drafted their own policies to have experienced employment counsel perform a policy or handbook review and provide advice and guidance regarding employer responsibilities and obligations, including but not limited to ensuring compliance with New Jersey’s new vehicle tracking device law.

COPYRIGHT © 2022, STARK & STARK
Article By Cory Rand with Stark & Stark.
For more articles about New Jersey Legislation, visit the NLR New Jersey law section.

Four Indicted for $16 Million Money Laundering Scheme

Four Indicted for $16 Million Money Laundering Scheme

On March 23, 2022, an indictment was unsealed in the Western District of Arkansas, charging four men for their involvement in wire fraud and money laundering schemes involving fake investment offerings amounting to an alleged $16 million.

According to court documents, the four men allegedly engaged in an investment fraud scheme between 2013 and 2021 in which they falsely represented the nature of their investment offerings and promised large returns, which they could not and did not yield. The indictment also alleges that two of the defendants encouraged victims to send their funds to bank accounts controlled by the other two defendants, and then transferred the money through a complex series of accounts worldwide.

The defendants were charged with wire fraud, conspiracy to commit wire fraud, and conspiracy to commit money laundering. One defendant was further charged with money laundering. If convicted, the men will face up to 20 years in prison for each count. The additional count of money laundering carries an additional sentence of up to 10 years.

The DOJ press release can be found here.

California Man Pleads Guilty To Stealing Government COVID-19 Relief Funds

On March 18, 2022, a California man pleaded guilty in the Central District of California to misappropriating COVID-19 relief funds obtained through the Coronavirus Aid, Relief, and Economic Security (CARES) Act.

Under the CARES Act Provider Relief Fund, CARES Act health care providers who were financially harmed by the impact of the COVID-19 pandemic are granted federal funds to provide care to patients suffering from COVID-19. According to court documents, the defendant admitted he owned a hospice agency in North Hollywood that was never operational during the COVID-19 pandemic, yet he received approximately $89,162 designated for the medical treatment and care of COVID-19 patients. The defendant admitted he misappropriated the CARES Act funds by spending them for his personal use and then transferring the funds to family members, including one family member in Armenia, rather than using the funds in any way related to the pandemic relief efforts as required.

As part of his guilty plea, the defendant further admitted that he submitted five Economic Injury Disaster Loan (EIDL) applications to the Small Business Administration (SBA) on behalf of his hospice agency and four other entities he controlled. As a result of his fraudulent applications, the SBA disbursed approximately $428,100 in EIDL funds to the man, which he used for his benefit against EIDL requirements.

The man pleaded guilty to three counts of theft of government property and is scheduled to be sentenced on June 13, facing up to 10 years in prison for each count.

The DOJ press release can be found here.

New Jersey Man Convicted for Fraudulently Obtaining US Visas for Chinese Government Employees

On March 23, 2022, a New Jersey man was convicted by a federal jury of one count of conspiracy to defraud the United States and to commit visa fraud for his participation in a conspiracy to fraudulently obtain United States visas for Chinese government employees.

According to court documents, the defendant was involved in a scheme to fraudulently obtain J-1 research scholar visas for employees of the government of the People’s Republic of China (PRC) to allow them to covertly work for the PRC government while in the United States. The defendant operated an office of the China Association for the International Exchange of Personnel (CAIEP), an agency of the PRC government, in New Jersey that seeks to recruit US scientists, academics, engineers, and other experts for the PRC.

The J-1 research scholar program allows foreign nationals to visit the United States to conduct research at a corporate research facility, library, museum, university, or other research institution. The defendant allegedly worked to obtain a J-1 research scholar visa for a prospective employee based on the false representation that the employee would conduct research at a United States university, to conceal unlawful work of another employee who was present in the United States on a J-1 visa sponsored by a US university. The two employees represented to the US government that they were entering the US for the primary purpose of conducting research at US universities, but their actual purpose consisted of working for the CAIEP. The defendant reported the employee’s arrival to the United States to the US universities, procured a local driver’s license for her and disguised her CAIEP salary as a subsidy for research scholar living expenses to make her presence as a research scholar appear legitimate.

As a result of his conviction, the defendant faces a maximum sentence of five years; he is scheduled to be sentenced on July 11.

The Department of Justice (DOJ) press release can be found here.

UPS To Pay $5.3 Million for False Claims Act Allegations

On March 21, 2022, the DOJ announced that United Parcel Service Inc. (UPS) agreed to pay approximately $5.3 million to settle allegations that the company falsely reported information about the transfer of U.S. mail to foreign posts or other intended recipients under contracts with the U.S. Postal Service (USPS), in violation of the False Claims Act (FCA).

UPS was engaged by USPS to pick up U.S. mail at various locations and deliver it to its international and domestic destinations. As a condition of payment, UPS was required to submit electronic scans to USPS to report when the mail was delivered, and there were specified penalties for mail that was delivered late or to the wrong location. The settlement resolves allegations that scans submitted by UPS were falsified times and that UPS, in fact, transferred possession of the mail.

According to DOJ, this is the fifth civil settlement involving air carrier liability for false delivery scans under the USPS International Commercial Air Contracts, pursuant to which the United States has recovered more than $70 million.

The DOJ press release can be found here.

© 2022 ArentFox Schiff LLP

Many New Jersey Employers Must Soon Offer Employee Retirement Savings Plans

The New Jersey Secure Choice Savings Program Act (the “Act”) is set to take effect on March 28, 2022 and will require many employers to offer their own retirement plan or provide access to a State-sponsored program.

This Act impacts all New Jersey businesses that:

  1. have employed at least 25 employees in the State during the previous calendar year;
  2. have been in business at least two years; and
  3. do not already offer a qualified retirement plan.

The Act mandates employers to offer their full and part-time employees a retirement savings in either the form of either a qualified retirement plan (e.g., a 401(k) or 403(b)), or through the New Jersey Secure Choice Savings Program (the “Program”). The State-sponsored Program is an individual retirement account (IRA) where employees contribute a portion of their pretax earnings via automatic payroll deductions.

Employers must first decide whether they want to sponsor a qualified retirement plan or opt for the State-sponsored Program. Those who fail to comply will be subject to penalties ranging from a written warning to a $500 fine per employee. Employers have nine months from the implementation date to comply with the Act. While the anticipated implementation date is March 28, 2022, the Treasury Department website dedicated to the program notes that implementation is not yet operational.

We suggest intermittently checking in on the website.

© 2022 Giordano, Halleran & Ciesla, P.C. All Rights Reserved
For more articles about employment law, visit the NLR Labor & Employment section.

New Jersey Employers Now Required to Provide Written Notice Before Using Tracking Devices in Employee Vehicles

On January 18, 2022, New Jersey Governor Phil Murphy signed into law Assembly Bill No. 3950. Under the law, private employers in New Jersey must provide employees with written notice before using tracking devices on vehicles operated by employees. The law takes effect on April 18, 2022.

The law defines “tracking device” as “an electronic or mechanical device which is designed or intended to be used for the sole purpose of tracking the movement of a vehicle, person, or device.” Devices “used for the purpose of documenting employee expense reimbursement” are excluded from the definition of “tracking device.” Notably, the law applies regardless of whether the employee uses a company-owned vehicle or the employee’s personal vehicle.

The New Jersey law expressly states that it does not “supersede regulations governing interstate commerce, including but not limited to, the usage of electronic communications devices as mandated by the Federal Motor Carrier Safety Administration.”

An employer that knowingly uses a tracking device on an employee-operated vehicle without providing written notice to the employee will be subject to a civil penalty in an amount not to exceed $1,000 for the first violation and not to exceed $2,500 for each subsequent violation.

This article was written by Robin Koshy and Steven Luckner of Ogletree Deakins law firm.

Health Care Settings Subject to New COVID-19 Requirements Issued by New Jersey and OSHA

Health care settings continue to be at the center of testing and treatment for COVID-19 and are the focus of new safety requirements implemented to minimize risks of transmission. Last month, Governor Murphy issued an Executive Order related to vaccination management, COVID-19 testing, and data collection, which mandates “covered health care and high-risk congregate settings” to establish a policy requiring “covered workers” to either submit proof of full vaccination or to submit to weekly COVD-19 testing. This requirement goes into effect on September 7, 2021.

In addition, the Occupational Health and Safety Administration (OSHA) has implemented an emergency temporary standard (ETS) applicable to certain health care settings, which includes extensive safety and health measures. The ETS provides for certain exceptions for coverage, and while the precise definitions are complicated and must be consulted, the focus appears to be on those settings where employees are interacting with patients who are suspected or confirmed for COVID-19. Unlike the Executive Order, the OSHA ETS does not include vaccine or testing requirements; however, certain New Jersey health care providers will be covered by both measures.

Which health care and high-risk congregate settings must comply with the Executive Order?

The scope of this Executive Order is quite broad and will impact most health care settings across New Jersey, both in terms of the covered health care settings and the covered workers to which the vaccine or testing requirements will apply.

The Executive Order defines “health care facility” extremely broadly as including:

acute, pediatric, inpatient rehabilitation, and psychiatric hospitals, including specialty hospitals, and ambulatory surgical centers; long-term care facilities; intermediate care facilities; residential detox, short-term, and long-term residential substance abuse disorder treatment facilities; clinic-based settings like ambulatory care [which would include all private medical offices], urgent care clinics, dialysis centers, Federally Qualified Health Centers, family planning sites, and Opioid Treatment Programs; community-based healthcare settings including Program of All-inclusive Care for the Elderly, pediatric and adult medical day care programs, and licensed home health agencies and registered health care service firms operating within the State.

High-risk congregate settings under the Executive Order include:

State and county correctional facilities; secure care facilities operated by the Juvenile Justice Commission; licensed community residences for individuals with intellectual and developmental disabilities (“IDD”) and traumatic brain injury (“TBI”); licensed community residences for adults with mental illness; and certified day programs for individuals with IDD and TBI.

“Covered workers” is defined to include full and part time employees and independent contractors, as well as individuals with operational, custodial and administrative support roles.

How to Comply and Penalties for Violations

Covered workers are not required to provide proof of having been fully vaccinated under the Executive Order, but those who do not submit proof of full vaccination must submit to COVID-19 testing one to two times per week. The settings covered by this Executive Order may choose to impose more frequent testing as well. A covered worker will not be considered fully vaccinated until two weeks have elapsed since receipt of the second dose of a two-dose series, or a single dose of a one-dose.

Acceptable proof of full vaccination includes: (1) CDC COVID-19 Vaccination Card; (2) Official record from the New Jersey Immunization Information System or other State immunization registry; (3) Record from a health care provider portal/medical record system on official letterhead signed by a physician, nurse practitioner, physician’s assistant, registered nurse or pharmacist; (4) Military immunization or health record from the U.S. Armed Forces; or (5) Docket® mobile phone application record or any state specific application that produces a digital health record. Records of such proofs must be maintained confidentially.

Those employees who do not submit proof of vaccination must submit to weekly testing, which can be either antigen or molecular tests with Emergency Use Authorization from the Food and Drug Administration or operating pursuant to the Laboratory Developed Test requirements by the U.S. Centers for Medicare and Medicaid Services. Covered settings may provide onsite COVID-19 tests, which can be either an antigen or molecular test. Covered settings must have a policy for tracking test results and are required to report results to the local public health department. However, in all other respects, vaccination and testing information must be kept confidential and separate from the employees’ personnel records.

The penalties for violations are stringent. Pursuant to N.J.S.A. 9:49, a violation may be considered a disorderly conduct offense, which can carry a penalty of a fine of up to $1,000 or 6 months imprisonment.

It should be noted that the requirements of the Executive Order with respect to screening and testing of unvaccinated workers do not override any requirement imposed by the covered setting regarding the testing and screening of symptomatic workers or vaccinated workers.

OSHA’s COVID-19 Emergency Temporary Standard (ETS) for Health Care Settings

Published on June 21, 2021[1] and in further effort to ensure the safety of health care workers, the OSHA ETS for health care and related industries provides that, unless an exception applies, in settings where employees provide health care services or health care support services, employers must develop and implement COVID-19 plans.

The analysis to determine whether an exception applies is complicated, and OSHA offers a flowchart to assist with this analysis. Among these exceptions are:

  • Private medical practices, where (i) the office is in a non-hospital setting, (ii) ALL non-employees are screened prior to entry, and (iii) anyone with suspected or confirmed COVID-19 is not permitted to enter the premises.
  • Well-defined hospital ambulatory care settings where all employees are fully vaccinated and all non-employees are screened prior to entry and people with suspected or confirmed COVID-19 are not permitted to enter those settings.
  • Home health care settings where all employees are fully vaccinated, all non-employees are screened prior to entry, and people with suspected or confirmed COVID-19 are not present.
  • Well-defined areas where there is no reasonable expectation that any person with suspected or confirmed COVID-19 will be present, the requirements in the ETS for personal protective equipment (PPE), physical distancing, and physical barriers do not apply to employees who are fully vaccinated.

For those covered health care settings with more than 10 employees, the COVID-19 plan must be in writing. It is not practicable to list every requirement in this alert without making it quite lengthy, but the following will highlight some of the notable plan requirements:

  • A designated safety coordinator who understands and is able to identify COVID-19 hazards in the workplace, is knowledgeable in infection control and has the authority to ensure compliance with the COVID-19 plan
  • A workplace hazard assessment (including involvement of non-managerial employees)
  • Policies and procedures to minimize the risk of transmission of COVID-19 to employees, which are extensive and include but are not limited to:
  • Limiting points of entry for patients and screening patients, clients and visitors at entry
  • Social distancing when indoors
  • Physical barriers between fixed work stations in non-patient areas
  • Cleaning and disinfecting surfaces and equipment in patient areas and in high touch areas at least once per day
  • Providing hand sanitizer with a minimum of 60% alcohol or easily accessible handwashing facilities
  • Providing Personal Protective Equipment (PPE) to employees with close contact exposure (within six feet in same room) to a person with suspected of confirmed COVID-19
  • Ensuring HVAC systems are used per manufacturer instructions and utilize Minimum Efficiency Reporting Value of 13 or higher if the system permits
  • Screening employees each workday/shift
  • Employees required to promptly notify employer of positive COVID-19 test, a suspected COVID-19 case or of COVID-19 symptoms

When an employee who has been physically present in the workplace tests positive, that employee must notify a designated employee within 24 hours

Employees should be trained on COVID-19 transmission and informed of their right not be retaliated against for exercising their rights under this ETS. Finally, health care settings with more than 10 employees must retain records of positive COVID-19 cases and all covered health care settings must report any COVID-19 fatalities and in-patient hospitalizations to OSHA.

ETS Requires Employers Pay Employees Forced to Quarantine or Isolate Under Defined Circumstances

Significantly, the ETS requires covered employers with ten or more employees to provide employees with substantial “medical removal protection benefits” if the employee must be removed from the workplace when the employer knows that the employee:

  1. Is COVID-19 positive, meaning that the employee was confirmed positive for or was diagnosed by a licensed health care provider with COVID-19;
  2. Has been told by a health care provider that they are suspected to have COVID-19;
  3. Is experiencing recent loss of taste and/or smell, with no other explanation; or is experiencing both fever (≥100.4° F) and new unexplained cough associated with shortness of breath; or
  4. Is required to be notified by the employer of close contact in the workplace to a person who is COVID-19 positive, UNLESS the employee has been fully vaccinated against COVID-19 (i.e., 2 weeks or more following the final dose), or had COVID-19 and recovered within the past 3 months, AND the employee does not experience the symptoms listed in item 3.

When an employee must quarantine or isolate under the aforementioned circumstances, medical removal benefits entitle the employee to regular pay the employee would have received had the employee not been absent from work, up to $1,400 per week until the employee is able to return to work. After three weeks of this leave, employers with 500 or less employees may reduce the benefits paid to two thirds of the employee’s regular rate of pay (up to $200 per day). If an employee removed from the workplace is too ill to work remotely, OSHA directs the employer to provide the employee with sick leave or other leave in accordance with the employer’s policies and applicable law. The employer’s payment obligation is reduced by the amount of compensation the employee receives from any other source, such as a publicly or employer-funded compensation program. Employers may also be entitled to an American Rescue Plan tax credit if they pay sick and family leave for qualified leave from April 1, 2021, through September 30, 2021. More information on the tax credit is available from the IRS.

Resources for Compliance

OSHA provides a lengthy COVID-19 plan template to assist health care providers, which may be customized for each workplace. There are additional resources available to health care providers including worksite checklists, sample employee screening questionnaires, an employee training presentation on the Health care ETS and a sample COVID-19 log. OSHA also offers an FAQ on the ETS standard.

Enforcement and Penalties

Violations of the OSHA ETS may carry a maximum penalty of $13,653 per serious violation or per day for failure to abate beyond the abatement date. Willful or repeated violations carry a penalty of $136,532 per violation. OSHA will use its discretion to determine whether an entity’s failure to comply with the ETS standard despite its best efforts warrants relaxation of the enforcement penalties. However, the agency expects that most employers should be able to achieve compliance within the stated deadlines. When addressing penalties for violations, the agency will also consider the size of the company and any past violations.

Takeaways

Health care settings continue to be at the frontline as we battle COVID-19. State and Federal guidelines and mandates are evolving, extremely complicated and can be difficult to navigate. As a threshold matter, it is critical to determine which measures apply to the health care setting. Compliance is critical to minimize the risks to patients and employees and to avoid penalties for non-compliance. Clear communication with employees is crucial to ensure that they are familiar with the requirements and expectations, as well as to understand the employer’s efforts to keep them safe.

[1] Covered health care employers must comply with all provisions in the ETS as of July 6, 2021  except those requirements related to ventilation, physical barriers, and training, which had a  compliance deadline of July 21, 2021

© Copyright 2021 Sills Cummis & Gross P.C.

Article By Jill Turner LeverStacy L. LandauPatricia M. Prezioso, and Charles H. Newman with Sills, Cummis & Gross PC.

For more COVID-19 updates, visit the NLR Healthcare Law section.